MedicSolution+ listed on killsec leak site following alleged data breach

• Ransomware group: killsec
• Country: Brazil
• Sector: Healthcare
• Announcement date: September 6, 2025

Killsec claims data breach against MedicSolution+

The threat actor group known as killsec has listed MedicSolution+ on their leak site, alleging a data breach. This announcement, made on September 6, 2025, marks a significant development in the ongoing tension between cybercriminals and healthcare providers. In such incidents, threat actors often utilize leak sites to pressure organizations into meeting their demands by threatening to release sensitive information to the public.

The killsec group has targeted MedicSolution+ by listing the organization on their leak platform. The announcement includes screenshots of various documents allegedly belonging to the company. The threat actor has initiated a countdown process, implying a potential demand for ransom in exchange for the non-disclosure or sale of the data. This tactic is a hallmark of double extortion, where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage during negotiations.

In double extortion schemes, the goal is to maximize the pressure on the victim. By setting a countdown timer, the attackers create a sense of urgency, hoping the organization will act quickly to prevent the public release of its private information. This method is particularly effective against sectors that handle highly sensitive information, as the reputational and legal consequences of a leak are severe.

Details regarding the alleged compromised data

The screenshots provided by the threat actor display various official documents and forms allegedly associated with the organization. However, there is no clear information regarding the full scope and specific types of the compromised data. While the presence of screenshots indicates that some information has been accessed, the total volume of the breach remains unquantified.

The listing specifically mentions the following types of affected data:

• Official documents
• Corporate forms

Because the specific contents and the total amount of data taken have not been disclosed by the group, the full extent of the exposure remains unknown at this time. The lack of specific details regarding file counts or data size means that the organization and its stakeholders cannot yet determine the full impact of the alleged breach.

Potential risks and implications

This incident may present a risk of exposure for sensitive data within MedicSolution+. As the organization is based in Brazil, a confirmed breach could lead to legal sanctions under the LGPD (General Data Protection Law). Compliance with data protection regulations is a critical concern for organizations, as failure to secure personal information can result in significant regulatory scrutiny and financial penalties.

The content of the shared documents may pose secondary risks, such as identity theft or targeted phishing attacks, for both employees and patients. When official documents and corporate forms are leaked, they often contain the personal details necessary for attackers to craft highly convincing social engineering campaigns. These attacks can target individuals within the organization or the patients served by the healthcare provider, leading to further security compromises.

Information regarding the killsec group is limited; however, their involvement in ransomware activities could threaten the organization's operational continuity and potentially impact the supply chain. Ransomware attacks frequently disrupt the daily operations of healthcare providers, making it difficult to maintain the continuity of care. Furthermore, if the attacker gains access to the digital infrastructure of a provider, the ripple effects can extend to the broader supply chain, affecting partners and service providers connected to the organization's network.

To mitigate such risks, organizations in the healthcare sector often implement defensive measures such as multi-factor authentication, regular security awareness training, and robust encryption for data at rest and in transit. Maintaining a strong incident response plan is also essential to manage the fallout of a potential breach and to navigate the legal requirements imposed by local data protection laws.